Chronic Care Management billing has moved from a routine reimbursement category to one of the Department of Justice’s preferred entry points into federal health care fraud cases.
Practices that bill CPT codes 99490, 99439, 99487, 99489, and 99491, along with the CMS code G0511 used by rural health clinics and federally qualified health centers, are now regularly flagged by data analytics tools before a single medical record is ever pulled.
Understanding how that data is flagged, and where it can be challenged, is often the difference between a manageable civil inquiry and a criminal referral.
What Chronic Care Management Billing Requires
CCM services cover the ongoing coordination, monitoring, and support that clinical staff provides to Medicare beneficiaries with two or more chronic conditions expected to last at least twelve months or until the patient’s death. The billing structure is time-based and tiered.
Non-complex CCM, billed under CPT 99490, requires at least 20 minutes of clinical staff time directed by a physician or qualified health care professional in a calendar month. CPT 99439 covers each additional 20 minutes beyond the first.
Complex CCM, billed under CPT 99487, requires an initial 60 minutes for establishing or revising a comprehensive care plan, with CPT 99489 covering each additional 30 minutes. CPT 99491 applies when the billing physician personally performs at least 30 minutes of care management rather than delegating it to clinical staff.
Each of these codes depends on documentation that supports the time claimed, a written or electronic care plan, patient consent to the service and any associated cost sharing, and around-the-clock access to care management.
“A practice cannot bill both non-complex and complex CCM for the same patient in the same month. This single rule generates a large share of the enforcement referrals now proceeding through DOJ’s Civil Division and U.S. Attorney’s Offices.
Why DOJ Audits Are Focusing on CCM Claims
DOJ’s Health Care Fraud Unit now works alongside a Data Fusion Center that combines claims analytics with financial tracing through a Financial Intelligence Review Team. The department has explicitly stated it intends to identify suspect billing patterns in near real-time rather than waiting for a complaint or a whistleblower.
The 2026 National Health Care Fraud Takedown resulted in charges against 455 defendants tied to more than $6.5 billion in alleged false claims, proving that the enforcement model now starts with macro-level anomalies, instead of individual chart reviews.
CCM billing is a natural target for this approach because the underlying claims are time-based, recurring, and highly susceptible to specific algorithmic triggers.
CCM Billing Flags
Data analysts feed Medicare claims through systems designed to detect specific outliers that suggest fraud rather than clinical routine:
Impossible Time Accumulations
Algorithms instantly flag providers whose total billed CCM time, when combined with standard Evaluation and Management (E&M) codes, exceeds reasonable working hours in a single day or month.
Cloned Care Plans
Data tools scan for uniform, copy-and-pasted billing metrics across a massive patient panel. If a practice bills precisely 20 minutes (CPT 99490) for 95% of its patients every single month without variation, the system assumes time is being fabricated rather than actively tracked.
Concurrent Billing Conflicts
Analytics seamlessly cross-reference claims to catch overlapping codes that cannot legally coexist. Billing complex (99487) and non-complex (99490) care for the same patient in the same month, or billing CCM alongside conflicting transitional care management codes, generates an automatic red flag.
Responding to Initial CCM Audit Requests
When a practice receives a healthcare audit request, a subpoena, or a Civil Investigative Demand (CID) targeting its CCM claims, the immediate response dictates the trajectory of the investigation.
Mishandling the initial days of an inquiry can inadvertently turn a civil documentation issue into a criminal obstruction problem.
1. Institute an Immediate Litigation Hold: Stop all automated data deletion
Immediately preserve all electronic health records, communication logs, time-tracking software data, and internal emails. Failure to secure these immediately can lead to allegations of spoliation if routine system purges delete relevant data.
2. Prohibit Record Alteration: Do not touch historical charts
Strictly avoid the urge to retroactively amend, append, or “clean up” historical charts. Any modifications made after an audit request is received can trigger criminal obstruction charges, even if the intent was to clarify that legitimate care was provided.
3. Engage Health Care Defense Counsel
Bring in experienced legal counsel before providing any substantive response to the government. Counsel will control the flow of information, manage communications with investigators, and protect internal reviews under attorney-client privilege.
4. Negotiate Scope and Formulate Defense
Work through counsel to negotiate the scope of the subpoena or data request to minimize operational disruption. From there, begin preparing a defensive narrative and reconstructing the clinical reality before the government fully entrenches its position based purely on its algorithm’s assumptions.
Building a Defense Before the Audit Data Becomes a Complaint
Lowther Walker represents physicians, physician groups, and healthcare organizations facing DOJ and OIG scrutiny over Chronic Care Management billing and other Medicare and Medicaid audit exposure.
If your practice has received an audit letter, a civil investigative demand, or a subpoena tied to CCM claims, early legal involvement gives counsel the best chance to challenge the government’s data before it generates a formal allegation. Schedule a free consultation with our attorneys today to discuss an effective response to your practice’s audit request.
Chronic Care Audit FAQs
What CPT codes fall under Chronic Care Management billing?
The primary codes are 99490 and 99439 for non-complex CCM, 99487 and 99489 for complex CCM, and 99491 when the billing physician personally furnishes the service. G0511 applies to rural health clinics and federally qualified health centers.
What is extrapolation in a DOJ or OIG audit?
Extrapolation is a method where investigators review a sample of claims, calculate an error rate within that sample, and apply the same rate to the provider’s entire claims universe to estimate total overpayments or damages.
Can a provider challenge the government’s sampling methodology?
Yes. If the sample was not drawn using a statistically valid method, was too small to support the claimed confidence interval, or defined errors too broadly, the resulting extrapolation can be challenged and often significantly reduced.
What documentation does CCM billing require to withstand an audit?
Providers need time logs supporting the minutes billed, a current care plan, documented patient consent including any cost-sharing disclosure, and evidence of 24/7 access to care management services.
Is billing non-complex and complex CCM for the same patient in one month allowed?
No. Billing both categories for the same beneficiary in the same calendar month is not permitted and is a common trigger for audits and enforcement referrals.
When should a practice contact a federal health care fraud attorney?
As soon as an audit letter, civil investigative demand, or subpoena arrives, and ideally before responding to any request for records or data, since early counsel involvement shapes how the government’s methodology can later be challenged.